CVE-2015-1807

jenkins: directory traversal from artifacts via symlink (SECURITY-162)

Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts.

CVSS 2.0 · 3.5 Low EPSS 1.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2015-1806

jenkins: Combination filter Groovy script unsecured (SECURITY-125)

The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.

CVSS 2.0 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3681

jenkins: cross-site scripting flaw in Jenkins core (SECURITY-143)

Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3680

jenkins: password exposure in DOM (SECURITY-138)

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.

CVSS 2.0 · 4.0 Medium EPSS 1.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3678

jenkins: cross-site scripting flaws in the monitoring plug-in (SECURITY-113)

Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Jenkins-ci Redhat

Products

Monitoring Plugin Openshift

CVE-2014-3674

Enterprise: gears fail to properly isolate network traffic

Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2014-3667

jenkins: plug-in code can be downloaded by anyone with read access (SECURITY-155)

Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.

CVSS 2.0 · 4.0 Medium EPSS 1.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2013-2034

Jenkins: Multiple CSRF in MavenAbstractArtifactRecord.doRedeploy and Jenkins.doEval

Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.

CVSS 2.0 · 6.8 Medium EPSS 1.6% KEV · Not listed

Vendors

Cloudbees Redhat

Products

Jenkins Openshift

CVE-2014-3666

jenkins: remote code execution flaw (SECURITY-150)

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.

CVSS 2.0 · 7.5 High EPSS 3.7% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2013-2033

Jenkins: Build Description XSS

Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 2.1 Low EPSS 1.9% KEV · Not listed

Vendors

Cloudbees Jenkins Redhat

Products

Jenkins Jenkins Openshift

CVE-2014-3665

jenkins: remote code execution from slaves (SECURITY-144)

Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.

CVSS 2.0 · 6.8 Medium EPSS 2.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3664

jenkins: directory traversal flaw (SECURITY-131)

Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.

CVSS 2.0 · 4.0 Medium EPSS 2.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3663

jenkins: job configuration issues (SECURITY-127, SECURITY-128)

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.

CVSS 2.0 · 6.0 Medium EPSS 1.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3661

jenkins: denial of service (SECURITY-87)

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3662

jenkins: username discovery (SECURITY-110)

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3602

OpenShift: /proc/net/tcp information disclosure

Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2014-3577

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

CVSS 3.0 · 4.8 Medium EPSS 9.2% KEV · Not listed

Vendors

Apache Redhat

Products

Httpasyncclient Httpclient Enterprise Linux and 15 more

CVE-2014-3496

Origin: Command execution as root via downloadable cartridge source-url

cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.

CVSS 2.0 · 10.0 Critical EPSS 5.2% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Origin

CVE-2014-2068

jenkins: information leak via system diagnostic functionalities (SECURITY-73)

The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.

CVSS 2.0 · 3.5 Low EPSS 1.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-2067

jenkins: stored cross-site scripting flaw (SECURITY-74)

Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."

CVSS 2.0 · 3.5 Low EPSS 1.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift